zelari-code 1.47.2 → 1.48.1

package/dist/cli/hooks/usePermissionBroker.js

@@ -20,6 +20,7 @@ import { startPermissionBroker, } from "../mcp/permissionBroker.js";
 import { createBrokerPermissionHandler, createBrokerQuestionHandler, } from "../mcp/brokerHandlers.js";
 import { createPermissionAskHandler } from "./permissionPicker.js";
 import { appendSystem } from "./messageHelpers.js";
+import { armPickerTimeout, askUserTimeoutMs } from "./askUserTimeout.js";
 export function usePermissionBroker(opts) {
     const { setPicker, setMessages } = opts;
     const handleRef = useRef(null);
@@ -42,13 +43,22 @@ export function usePermissionBroker(opts) {
                 return;
             }
             let settled = false;
+            let cancelWaitTimeout;
             const finish = (value) => {
                 if (settled)
                     return;
                 settled = true;
+                cancelWaitTimeout?.();
                 setPicker(null);
                 resolve(value);
             };
+            // v1.47.x: timeout so an unseen external-agent question cannot block
+            // the broker client forever. Knob: ZELARI_ASK_USER_TIMEOUT_MS.
+            const waitTimeoutMs = askUserTimeoutMs();
+            cancelWaitTimeout = armPickerTimeout(() => {
+                appendSystem(setMessages, `[external agent] nessuna risposta entro ${Math.round(waitTimeoutMs / 1000)}s — richiesta annullata.`, Date.now());
+                finish(null);
+            }, waitTimeoutMs);
             appendSystem(setMessages, `[external agent] ${req.question}\n→ ${choices.join(" · ")}`, Date.now());
             setPicker({
                 kind: "clarification",

package/dist/cli/hooks/usePermissionBroker.js.map

@@ -1 +1 @@
-{"version":3,"file":"usePermissionBroker.js","sourceRoot":"","sources":["../../../src/cli/hooks/usePermissionBroker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAG1C,OAAO,EACL,qBAAqB,GAEtB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,0BAA0B,EAAkB,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,UAAU,mBAAmB,CAAC,IAGnC;IACC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACxC,MAAM,SAAS,GAAG,MAAM,CAAgC,IAAI,CAAC,CAAC;IAE9D,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;QAC1D,IAAI,CAAC,UAAU;YAAE,OAAO;QAExB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,MAAM,GAAkC,IAAI,CAAC;QAEjD,MAAM,eAAe,GAAG,0BAA0B,CAAC;YACjD,SAAS;YACT,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;SAC5E,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,CAAC,GAInB,EAA0B,EAAE,CAC3B,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,EAAE;YACrC,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;iBAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC/B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,OAAO,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,MAAM,GAAG,CAAC,KAAoB,EAAE,EAAE;gBACtC,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,SAAS,CAAC,IAAI,CAAC,CAAC;gBAChB,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC,CAAC;YACF,YAAY,CACV,WAAW,EACX,oBAAoB,GAAG,CAAC,QAAQ,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAC5D,IAAI,CAAC,GAAG,EAAE,CACX,CAAC;YACF,SAAS,CAAC;gBACR,IAAI,EAAE,eAAe;gBACrB,KAAK,EAAE,GAAG,CAAC,QAAQ;gBACnB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;gBACnD,QAAQ,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC1C,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;aAC7B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEL,KAAK,qBAAqB,CAAC,UAAU,EAAE;YACrC,YAAY,EAAE,6BAA6B,CAAC,EAAE,eAAe,EAAE,CAAC;YAChE,UAAU,EAAE,2BAA2B,CAAC,EAAE,UAAU,EAAE,CAAC;SACxD,CAAC;aACC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YACV,IAAI,QAAQ,EAAE,CAAC;gBACb,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC,CAAC;YACX,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC;YACtB,YAAY,CACV,WAAW,EACX,oCAAoC,UAAU,2CAA2C,EACzF,IAAI,CAAC,GAAG,EAAE,CACX,CAAC;YACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gDAAgD,UAAU,IAAI,CAC/D,CAAC;QACJ,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oDACE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,IAAI,CACL,CAAC;QACJ,CAAC,CAAC,CAAC;QAEL,OAAO,GAAG,EAAE;YACV,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,MAAM;gBAAE,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YAC/B,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC;QAC3B,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IAE7B,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,SAAS,EAAE,CAAC;AAC7E,CAAC"}
+{"version":3,"file":"usePermissionBroker.js","sourceRoot":"","sources":["../../../src/cli/hooks/usePermissionBroker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAG1C,OAAO,EACL,qBAAqB,GAEtB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,0BAA0B,EAAkB,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEzE,MAAM,UAAU,mBAAmB,CAAC,IAGnC;IACC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACxC,MAAM,SAAS,GAAG,MAAM,CAAgC,IAAI,CAAC,CAAC;IAE9D,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;QAC1D,IAAI,CAAC,UAAU;YAAE,OAAO;QAExB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,MAAM,GAAkC,IAAI,CAAC;QAEjD,MAAM,eAAe,GAAG,0BAA0B,CAAC;YACjD,SAAS;YACT,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;SAC5E,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,CAAC,GAInB,EAA0B,EAAE,CAC3B,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,EAAE;YACrC,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;iBAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC/B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,OAAO,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,iBAA2C,CAAC;YAChD,MAAM,MAAM,GAAG,CAAC,KAAoB,EAAE,EAAE;gBACtC,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,iBAAiB,EAAE,EAAE,CAAC;gBACtB,SAAS,CAAC,IAAI,CAAC,CAAC;gBAChB,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC,CAAC;YACF,qEAAqE;YACrE,+DAA+D;YAC/D,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;YACzC,iBAAiB,GAAG,gBAAgB,CAAC,GAAG,EAAE;gBACxC,YAAY,CACV,WAAW,EACX,2CAA2C,IAAI,CAAC,KAAK,CACnD,aAAa,GAAG,IAAI,CACrB,0BAA0B,EAC3B,IAAI,CAAC,GAAG,EAAE,CACX,CAAC;gBACF,MAAM,CAAC,IAAI,CAAC,CAAC;YACf,CAAC,EAAE,aAAa,CAAC,CAAC;YAClB,YAAY,CACV,WAAW,EACX,oBAAoB,GAAG,CAAC,QAAQ,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAC5D,IAAI,CAAC,GAAG,EAAE,CACX,CAAC;YACF,SAAS,CAAC;gBACR,IAAI,EAAE,eAAe;gBACrB,KAAK,EAAE,GAAG,CAAC,QAAQ;gBACnB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;gBACnD,QAAQ,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC1C,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;aAC7B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEL,KAAK,qBAAqB,CAAC,UAAU,EAAE;YACrC,YAAY,EAAE,6BAA6B,CAAC,EAAE,eAAe,EAAE,CAAC;YAChE,UAAU,EAAE,2BAA2B,CAAC,EAAE,UAAU,EAAE,CAAC;SACxD,CAAC;aACC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YACV,IAAI,QAAQ,EAAE,CAAC;gBACb,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC,CAAC;YACX,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC;YACtB,YAAY,CACV,WAAW,EACX,oCAAoC,UAAU,2CAA2C,EACzF,IAAI,CAAC,GAAG,EAAE,CACX,CAAC;YACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gDAAgD,UAAU,IAAI,CAC/D,CAAC;QACJ,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oDACE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,IAAI,CACL,CAAC;QACJ,CAAC,CAAC,CAAC;QAEL,OAAO,GAAG,EAAE;YACV,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,MAAM;gBAAE,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YAC/B,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC;QAC3B,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IAE7B,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,SAAS,EAAE,CAAC;AAC7E,CAAC"}

package/dist/cli/main.bundled.js

@@ -628,7 +628,12 @@ async function refreshGrokToken(options) {
         grant_type: "refresh_token",
         client_id: options.clientId,
         refresh_token: options.refreshToken
-      }).toString()
+      }).toString(),
+      // v1.47.x: hard 30s cap. A hung auth socket used to freeze the whole
+      // turn on "working" forever with no error (the refresh promise never
+      // settled). A visible failure is strictly better: callers fall back
+      // to the current token and surface the error.
+      signal: AbortSignal.timeout(3e4)
     });
   } catch (err) {
     throw new GrokOAuthError(
@@ -29126,6 +29131,7 @@ __export(openai_compatible_exports, {
   parseCachedPromptTokens: () => parseCachedPromptTokens,
   providerConfigFor: () => providerConfigFor,
   providerFromEnv: () => providerFromEnv,
+  readChunkWithTimeout: () => readChunkWithTimeout,
   resolveActiveProvider: () => resolveActiveProvider,
   resolveBaseUrl: () => resolveBaseUrl
 });
@@ -29151,13 +29157,20 @@ async function readChunkWithTimeout(reader, opts) {
   if (opts.signal?.aborted) {
     throw new Error("aborted");
   }
-  const remaining = opts.deadlineMs - Date.now();
+  const now = Date.now();
+  const remaining = opts.deadlineMs - now;
   if (remaining <= 0) {
     throw new Error(
       `Provider stream exceeded max duration (${Math.round(PROVIDER_STREAM_MAX_MS / 1e3)}s). Raise ZELARI_PROVIDER_STREAM_MAX_MS if needed.`
     );
   }
-  const waitMs = Math.min(opts.idleMs, remaining);
+  const idleElapsed = now - opts.lastUsefulAt();
+  if (idleElapsed >= opts.idleMs) {
+    throw new Error(
+      `Provider stream idle for ${Math.round(idleElapsed / 1e3)}s (no content tokens \u2014 keep-alive frames don't count). The model/gateway stalled \u2014 try again or switch model. Override with ZELARI_PROVIDER_STREAM_IDLE_MS.`
+    );
+  }
+  const waitMs = Math.min(opts.idleMs - idleElapsed, remaining);
   let idleTimer;
   let onAbort;
   try {
@@ -29444,6 +29457,7 @@ function openaiCompatibleProvider(config2) {
         if (args === null) continue;
         toolCallAccumulator.delete(idx);
         emittedToolCall = true;
+        markUseful();
         yield {
           kind: "tool_call",
           toolCallId: existing.id || `tc-${idx}`,
@@ -29454,6 +29468,10 @@ function openaiCompatibleProvider(config2) {
       toolCallAccumulator.clear();
     };
     const streamDeadline = Date.now() + PROVIDER_STREAM_MAX_MS;
+    let lastUsefulAt = Date.now();
+    const markUseful = () => {
+      lastUsefulAt = Date.now();
+    };
     try {
       while (true) {
         let chunk;
@@ -29461,7 +29479,8 @@ function openaiCompatibleProvider(config2) {
           chunk = await readChunkWithTimeout(reader, {
             idleMs: PROVIDER_STREAM_IDLE_MS,
             deadlineMs: streamDeadline,
-            signal: params.signal
+            signal: params.signal,
+            lastUsefulAt: () => lastUsefulAt
           });
         } catch (err) {
           const msg = err instanceof Error ? err.message : String(err);
@@ -29502,6 +29521,7 @@ function openaiCompatibleProvider(config2) {
               const completionTokens = typeof parsed.usage.completion_tokens === "number" ? parsed.usage.completion_tokens : 0;
               const totalTokens = typeof parsed.usage.total_tokens === "number" ? parsed.usage.total_tokens : promptTokens + completionTokens;
               const cachedPromptTokens = parseCachedPromptTokens(parsed.usage);
+              markUseful();
               yield {
                 kind: "usage",
                 usage: {
@@ -29513,10 +29533,12 @@ function openaiCompatibleProvider(config2) {
               };
             }
             if (typeof delta?.content === "string" && delta.content.length > 0) {
+              markUseful();
               yield { kind: "text", delta: delta.content };
             }
             const reasoning = delta?.reasoning_content ?? delta?.reasoning;
             if (typeof reasoning === "string" && reasoning.length > 0) {
+              markUseful();
               yield { kind: "thinking", delta: reasoning };
             }
             const details = delta?.reasoning_details;
@@ -29528,9 +29550,13 @@ function openaiCompatibleProvider(config2) {
                 if (t.startsWith(reasoningDetailsBuf)) {
                   const piece = t.slice(reasoningDetailsBuf.length);
                   reasoningDetailsBuf = t;
-                  if (piece.length > 0) yield { kind: "thinking", delta: piece };
+                  if (piece.length > 0) {
+                    markUseful();
+                    yield { kind: "thinking", delta: piece };
+                  }
                 } else {
                   reasoningDetailsBuf += t;
+                  markUseful();
                   yield { kind: "thinking", delta: t };
                 }
               }
@@ -29551,6 +29577,7 @@ function openaiCompatibleProvider(config2) {
             }
             if (choice?.finish_reason) {
               yield* flushToolAccumulator();
+              markUseful();
               const reason = choice.finish_reason === "stop" && emittedToolCall ? "tool_calls" : choice.finish_reason;
               yield { kind: "finish", reason };
             }
@@ -48395,9 +48422,17 @@ function WorkingIndicator({
 // src/cli/components/LiveRegion.tsx
 var LIVE_STREAM_TAIL_LINES = 10;
 var MAX_LIVE_TOOLS = 4;
-function LiveRegion({ live, busy, elapsedMs = null }) {
+function LiveRegion({
+  live,
+  busy,
+  elapsedMs = null,
+  waitingForUser = false,
+  waitingSinceMs = 0
+}) {
   const { streaming, runningTools } = live;
-  if (!streaming && runningTools.length === 0 && !busy) return null;
+  if (!streaming && runningTools.length === 0 && !busy && !waitingForUser) {
+    return null;
+  }
   const visibleTools = runningTools.slice(0, MAX_LIVE_TOOLS);
   const hiddenTools = runningTools.length - visibleTools.length;
   return /* @__PURE__ */ React5.createElement(Box4, { flexDirection: "column", paddingX: 1 }, streaming && streaming.role === "assistant" && /* @__PURE__ */ React5.createElement(
@@ -48409,7 +48444,7 @@ function LiveRegion({ live, busy, elapsedMs = null }) {
       memberName: streaming.memberName,
       memberId: streaming.memberId
     }
-  ), visibleTools.map((t) => /* @__PURE__ */ React5.createElement(Box4, { key: t.id, flexDirection: "column" }, renderMessage(t, true))), hiddenTools > 0 ? /* @__PURE__ */ React5.createElement(Text5, { dimColor: true }, "  \u2026 +", hiddenTools, " more tools") : null, busy && runningTools.length === 0 && !streaming && /* @__PURE__ */ React5.createElement(WorkingIndicator, { elapsedMs }));
+  ), visibleTools.map((t) => /* @__PURE__ */ React5.createElement(Box4, { key: t.id, flexDirection: "column" }, renderMessage(t, true))), hiddenTools > 0 ? /* @__PURE__ */ React5.createElement(Text5, { dimColor: true }, "  \u2026 +", hiddenTools, " more tools") : null, waitingForUser && /* @__PURE__ */ React5.createElement(Text5, { color: "yellow", bold: true }, "\u23F8 In attesa della TUA risposta", waitingSinceMs > 0 ? ` (${Math.floor(Math.max(0, Date.now() - waitingSinceMs) / 1e3)}s)` : "", " \u2014 \u2191/\u2193 + Invio \xB7 Esc = annulla"), busy && runningTools.length === 0 && !streaming && !waitingForUser && /* @__PURE__ */ React5.createElement(WorkingIndicator, { elapsedMs }));
 }
 function StreamingTail(m) {
   const lines = m.content.split("\n");
@@ -51259,6 +51294,22 @@ init_taskTool();
 
 // src/cli/hooks/permissionPicker.ts
 init_toolPermissions();
+
+// src/cli/hooks/askUserTimeout.ts
+function askUserTimeoutMs() {
+  const raw = process.env.ZELARI_ASK_USER_TIMEOUT_MS?.trim();
+  if (!raw) return 3e5;
+  const n = Number.parseInt(raw, 10);
+  if (!Number.isFinite(n) || n < 0) return 3e5;
+  return n;
+}
+function armPickerTimeout(onFire, ms) {
+  if (ms <= 0) return () => void 0;
+  const id = setTimeout(onFire, ms);
+  return () => clearTimeout(id);
+}
+
+// src/cli/hooks/permissionPicker.ts
 function createPermissionAskHandler(opts) {
   const { setPicker: setPicker2, appendSystem: appendSystem2 } = opts;
   return (req) => new Promise((resolve3) => {
@@ -51273,13 +51324,25 @@ ${detail}
       Date.now()
     );
     let settled = false;
+    const askTimeoutMs = askUserTimeoutMs();
+    let cancelAskTimeout = () => void 0;
     const finish = (ok, note) => {
       if (settled) return;
       settled = true;
+      cancelAskTimeout();
       setPicker2(null);
       if (note) appendSystem2?.(note, Date.now());
       resolve3(ok);
     };
+    cancelAskTimeout = armPickerTimeout(
+      () => finish(
+        false,
+        `[permission] ask for "${req.toolName}" timed out after ${Math.round(
+          askTimeoutMs / 1e3
+        )}s \u2014 denied (tool can be re-run). Knob: ZELARI_ASK_USER_TIMEOUT_MS.`
+      ),
+      askTimeoutMs
+    );
     const items = [
       { value: "allow", label: "Allow once" },
       {
@@ -51629,12 +51692,28 @@ _(${req.context})_` : "") + "\n\u2192 scegli dalla lista (il turno continua dopo
             Date.now()
           );
           let settled = false;
+          const askTimeoutMs = askUserTimeoutMs();
+          let cancelAskTimeout = () => void 0;
           const finish = (value) => {
             if (settled) return;
             settled = true;
+            cancelAskTimeout();
             setPicker2(null);
             resolve3(value);
           };
+          cancelAskTimeout = armPickerTimeout(
+            () => {
+              appendSystem(
+                setMessages,
+                `[ask_user] nessuna risposta entro ${Math.round(
+                  askTimeoutMs / 1e3
+                )}s \u2014 proseguo con assunzione documentata (ZELARI_ASK_USER_TIMEOUT_MS).`,
+                Date.now()
+              );
+              finish(null);
+            },
+            askTimeoutMs
+          );
           setPicker2({
             kind: "clarification",
             title: req.question,
@@ -52344,12 +52423,28 @@ _(${req.context})_` : "") + "\n\u2192 scegli dalla lista (il membro riprende dop
       Date.now()
     );
     let settled = false;
+    const askTimeoutMs = askUserTimeoutMs();
+    let cancelAskTimeout = () => void 0;
     const finish = (value) => {
       if (settled) return;
       settled = true;
+      cancelAskTimeout();
       setPicker2(null);
       resolve3(value);
     };
+    cancelAskTimeout = armPickerTimeout(
+      () => {
+        appendSystem(
+          setMessages,
+          `[council ask_user] nessuna risposta entro ${Math.round(
+            askTimeoutMs / 1e3
+          )}s \u2014 il membro prosegue con assunzione documentata (ZELARI_ASK_USER_TIMEOUT_MS).`,
+          Date.now()
+        );
+        finish(null);
+      },
+      askTimeoutMs
+    );
     setPicker2({
       kind: "clarification",
       title: req.question,
@@ -53114,12 +53209,25 @@ function usePermissionBroker(opts) {
         return;
       }
       let settled = false;
+      let cancelWaitTimeout;
       const finish = (value) => {
         if (settled) return;
         settled = true;
+        cancelWaitTimeout?.();
         setPicker2(null);
         resolve3(value);
       };
+      const waitTimeoutMs = askUserTimeoutMs();
+      cancelWaitTimeout = armPickerTimeout(() => {
+        appendSystem(
+          setMessages,
+          `[external agent] nessuna risposta entro ${Math.round(
+            waitTimeoutMs / 1e3
+          )}s \u2014 richiesta annullata.`,
+          Date.now()
+        );
+        finish(null);
+      }, waitTimeoutMs);
       appendSystem(
         setMessages,
         `[external agent] ${req.question}
@@ -56395,6 +56503,11 @@ function App() {
   const [mode, setMode] = useState8("kraken");
   const [phase2, setPhaseUi] = useState8("build");
   const [picker, setPicker2] = useState8(null);
+  const [pickerSince, setPickerSince] = useState8(0);
+  useEffect8(() => {
+    if (picker) setPickerSince((s) => s > 0 ? s : Date.now());
+    else setPickerSince(0);
+  }, [picker]);
   const activeProviderSpec = getActiveProvider();
   const activeModel = providerConfig.modelByProvider[activeProviderSpec.id];
   const session = useSession();
@@ -56519,7 +56632,16 @@ function App() {
       columns: size.columns || 80,
       rows: size.rows || 24
     }
-  ) : renderMessage(item)), /* @__PURE__ */ React10.createElement(Box9, { flexDirection: "row" }, /* @__PURE__ */ React10.createElement(Box9, { flexDirection: "column", flexGrow: 1, paddingX: 1 }, /* @__PURE__ */ React10.createElement(LiveRegion, { live: session.live, busy, elapsedMs: timer.elapsedMs }), picker ? /* @__PURE__ */ React10.createElement(
+  ) : renderMessage(item)), /* @__PURE__ */ React10.createElement(Box9, { flexDirection: "row" }, /* @__PURE__ */ React10.createElement(Box9, { flexDirection: "column", flexGrow: 1, paddingX: 1 }, /* @__PURE__ */ React10.createElement(
+    LiveRegion,
+    {
+      live: session.live,
+      busy,
+      elapsedMs: timer.elapsedMs,
+      waitingForUser: picker !== null,
+      waitingSinceMs: pickerSince
+    }
+  ), picker ? /* @__PURE__ */ React10.createElement(
     SelectList,
     {
       title: picker.title,